Cisco Certified Support Technician (CCST) CybersecurityNetwork SecurityHard
A network security engineer is designing a secure network architecture for a critical industrial control system (ICS). Due to the highly sensitive nature of the system, all communication between the operational technology (OT) network and the enterprise IT network must be strictly controlled and unidirectional, allowing data to flow only from OT to IT, but never the other way. Which specialized security technology is specifically designed to enforce this type of unidirectional data flow?
- AIntrusion Detection System (IDS)
- BNext-Generation Firewall (NGFW)
- CData Diode
- DDemilitarized Zone (DMZ)
Show answer & explanationAnswer & explanation
Correct answer: C. Data Diode
A data diode (or unidirectional gateway) is a hardware-based security device that physically enforces one-way data flow. It's often used in highly secure environments like ICS/SCADA systems to prevent any data leakage or control signals from moving from a less secure network (IT) to a more secure one (OT), fulfilling the strict unidirectional requirement.
Why the other options are wrong
- A. An IDS detects intrusions but does not enforce unidirectional data flow.
- B. NGFWs provide advanced filtering and inspection but are inherently bidirectional and rely on software rules, which can be misconfigured or bypassed.
- D. A DMZ provides a buffer zone between networks but allows bidirectional traffic, albeit controlled, and doesn't enforce physical unidirectional flow.
Data Diode
A data diode is a hardware device that enforces one-way data flow, ensuring that data can only travel in a single direction across a network boundary.
- Physically enforces unidirectional data flow
- Used in critical infrastructure (ICS/SCADA)
- Prevents data leakage and reverse control signals
Memory trick: A data diode is a one-way street for data.